Preparing for ransomware and commodity malware in OT environments

As awareness of OT cyber threats and attacks increases, a great deal of focus on state espionage and sabotage. Researchers and journalists focus on new exploits and the most sophisticated campaigns and adversary tactics. Practically, however, most organisations are just beginning their cyber security journey in OT, and their initial forays into incident response relate to ransomware infections and older worms causing havoc on obsolete operating systems and taxed infrastructure. 

People installing detection for the first time in decades of operation are finding dozens of infections that may or may not cause an issue, and the problem can feel insurmountable and overwhelming. Is the right answer disrupting operations to clean the network? To leave the infection in place? Or to perform a massively expensive system upgrade earlier than planned and budgeted?

In this talk, we will suggest pragmatic plans and responses to both modern ransomware and legacy, commodity infections in OT environments. We will focus on a balance of preserving operations and priortising safety, while also ensuring long term process reliability and removing intrusion vectors and malignant malware.